Cyren Security Blog

Double Deceit: Bad Things Come in Pairs

by Maharlito Aquino and Kervin Alintanahin

The chinese proverb may say that good things come in pairs, but in what appears to be a clever bit of social and technical engineering, we’ve discovered a new email threat carrying not one, but two different malicious attachments as bait, specifically a PDF file and a Microsoft Template file (OpenXML/DOTX), targeting a previously reported Microsoft Office vulnerability in order to deliver the remote access trojan (RAT) known as NetWiredRC. We believe the use of two attachments is intended to make the email seem more legitimate to recipients. Typically hackers only send one malicious attachment—by sending two, instead of sending the user some Chinese "double happiness," the hackers increase the chances that the target will open at least one of them. In addition, the techniques applied within the attachments add a few layers of complexity in both the delivery of the exploit and the final payload, and are intended to help evade detection.

Double Trouble in a Fake Business Email

The email being sent is in the guise of a business transaction purporting to be a request for quote (RFQ), a sample of which is shown below. From a technical perspective, our analysis shows that neither attachment contains the actual exploit. Instead the threat abuses features in both the attached PDF and OpenXML documents to cause the automatic download and launch of the CVE-2017-11882 exploit, known as the Microsoft Office Memory Corruption Vulnerability, for which Microsoft issued a patch in November 2017.

Cyren blocks this threat in its various elements as DOCX/CVE-2017-11882.D.gen!Camelot, DOCX/CVE-2017-11882.F.gen!Camelot, and W32/NetWiredRC.CW.

Figure 1. Email Sample containing two (2) bait attachments

How the PDF Works

In examining the PDF’s file structure, we find an embedded file named jon001.dotx, which appears to be a ZIP archive, but is actually a Word document using the Microsoft OpenXML format (detected by Cyren as DOCX/CVE-2017-11882.F.gen!Camelot). The embedded DOTX file (jon001.dotx) is the same as the attached DOTX (specification.dotx), as shown below in the hash comparison between the two files.

Figure 2.0. Shows the embedded and attached file hashes

Figure 2.1. The PDF contains an embedded file called “jon001.dotx” which downloads and launches the DOCX/CVE-2017-11882 exploit.

The embedded document is set as an open action object, so it will also be loaded once the PDF is opened.

Figure 2.2. PDF Stream showing the OpenAction object

When the intended victim tries to open the PDF file, he is also prompted to open the embedded file. It is important to note, however, that if the user has configured Adobe Reader to “Always Allow” the opening of similar file types, then this particular embedded object will automatically be loaded without prompting the user. (Cyren recommends that to prevent the automatic loading of embedded files that may contain harmful content, computer users never set Adobe Reader to a default setting of “Always Allow”.)

Figure 3.0. Adobe Reader prompts user about opening the embedded document.

Initially, the embedded document (jon001.dotx) does not appear to contain any exploits, but upon closer inspection into the document element (word/document.xml), we find the automatic loading of remote data via the linked OLEObject element.

Figure 4.0. Linked OLEObject

Following the reference ID (_id_1437) for this OLEObject in rels/document.xml.rels, reveals the URL from which the remote data will be downloaded.

Figure 4.1. Remote data URL

Exploit Document

The remote data is found in an RTF document called jon001.doc (detected by Cyren as CVE-2017-11882.D.gen!Camelot). Similar to CVE-2017-0199, the CVE-2017-11882 RTF exploit takes advantage of the \objupdate keyword to be able to trigger the malicious payload without user interaction.

Figure 5.0. Preview of the RTF structure

Unlike previous variants of malicious documents exploiting CVE-2017-11882 (which usually trigger the exploit thru a URL moniker in a Microsoft Equation stream in the OLE object), this variant triggers the exploit using a shellcode found in an Ole10Native stream in the OLE object from the RTF document. Viewing the document in Microsoft Word would show the OleObject as an embedded Equation Object.

Figure 6.0. Embedded Equation Object

Figure 7.0. Shellcode found in the Ole10Native Stream.

We first confirmed that the exploit was still taking advantage of the flaw in Equation Editor, and then used the Microsoft Global Flags Editor (Gflags) debugger utility to break on EQNEDT32.exe once the exploit is triggered.

Figure 8.0. Global Flags Image File Debugger Configuration

Based on an address range and data contained in a Palo Alto’s report on the CVE-2017-11882 exploit, we used the same information to debug the shellcode to confirm that the exploit attempts to download and execute a file from hxxp://asurahomepg.ru/two/jon001.exe which is saved to disk using the filepath, %APPDATA%\windows.exe.

Figure 9.0. CVE-2017-11882 Shellcode Debugging

Backdoor Payload

Unfortunately, the download URL was inaccessible at the time of our analysis, so we were not able to obtain the intended executable payload. However, we were able to download another payload using the same filename (jon001.exe) from a different directory at the same site (hxxp://asurahomepg.ru/one/jon001.exe). Cyren detects the “jon001.exe” file as a backdoor trojan named W32/NetWiredRC.CW.

A quick analysis of the jon001.exe downloaded executable shows that it is compiled in Visual Basic and is decompressed at runtime and injected into a suspended process of itself. By dumping the decompressed format of the payload into a file, we were able to identify it as a variant of a RAT known as NetWiredRC.

The strings used in this backdoor are encrypted with two different encryption algorithms.

Decryption #1

The first set of encrypted strings are encrypted with a custom Caesar Cipher using the following key:

 _BqwHaF8TkKDMfOzQASx4VuXdZibUIeylJWhj0m5o2ErLt6vGRN9sY1n3Ppc7g and an offset modifier of 6.

Figure 11.0. Base64 decryption routine

The decryption routine can be written in Python as follows:

CIPHER_TEXT = '_BqwHaF8TkKDMfOzQASx4VuXdZibUIeylJWhj0m5o2ErLt6vGRN9sY1n3Ppc7g-C'
OFFSET = 6
def ceasar_decrypt(encoded, key=CIPHER_TEXT, offset=OFFSET):
    return ''.join([key[(key.index(enc)+offset) & 0x3f] if enc in key else enc for enc in encoded])

By writing an IDA Python script to use the above decryption function on the first set of strings, we are able to reveal strings used by the backdoor for its keylogging routine and other functionalities.

Figure 11.1. Decrypted Keylogging Strings.

Decryption #2

The second set of encrypted strings are decoded with RC4 using the following cipher key: 3F738FEA334633468BA981AFE2C1A8E8

Using another IDA Python script to decrypt the second set of strings reveals the backdoor’s Command & Control (C&C) configuration.

Figure 12.0. CnC Config Decryption Routine

This backdoor has many capabilities including but not limited to the following:

  • Key log strokes

Figure 13.0. Keylogging Routine

  • Steal Browser Login Data
    • Internet Explorer
    • Comodo
    • Yandex
    • Chrome
    • Chromium
    • Opera
    • Firefox
  • Steal User Credentials
    • Windows Live
    • Pidgin
  • Steal Email Credentials
    • Microsoft Office Outlook

Figure 14.0. Credentials/Login Data Stealer Routines

  • Initiate/terminate a remote shell
  • Search/Copy/Move/Delete/Execute Files

Indicators of Compromise

File Hashes
444455ccce5faecd9349604bef1ac0595e80e3b315809eb04e4e3bb57026436d
4f45983598fc0bca7df0c58063a892f34e492ab24ce1fda74bac505d49a08e51
cbb7017d9eb618a6d60dff3c59b1d788e0c57a42ced96328b1df7dd37c86664c
cc1b07ced91684f23866fabb00a1b3c18a0ed542d6a5678fc3cfe44a97386b0f
80dba571dbd3bb49238df6256c872df9268a92e6794750cfcc255fc42c15aac9

 

Download URLs
hxxp://utasarmsinc.ru/doc/jon001.doc (exploit doc)
hxxp://asurahomepg[.]ru/one/jon001.exe (payload)
hxxp://asurahomepg[.]ru/two/jon001.exe (payload)

 

C&C Host
dinesaad.hopto.org:8123

 

Prevention and Mitigation

Cyren recommends that businesses take the following actions to protect from these and similar threats:

Patch early, patch often. Microsoft issued a patch for the CVE-2017-11882 exploit in 2017. Outdated software, operating systems, browsers, and plugins are major vectors for malware infections.

Deploy cloud-based email gateway protection from a security provider. Cloud-based Secure Email Gateways add more advanced security like time-of-click URL analysis and protection from attacks.

Deploy a web security gateway. An effective web security gateway will block access to malicious sites, as well as stop new and zero-day malware downloads and communications with botnet C&C servers.

Train users to not enable “Always Allow” when reading PDFs on Adobe Acrobat. By enabling “always allow” in Adobe Acrobat” users risk the automatic download of malicious files.

Go back